Executive brief
MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including tracking experiments and datasets. A security flaw in how the system generates unique identifiers (digests) for datasets allows for predictable collisions, meaning two different datasets could be incorrectly identified as the same. This could lead to data integrity issues where incorrect models or data are used in production environments, potentially impacting the reliability of AI-driven operations.
Technical details
A vulnerability exists in the `mlflow.data.digest_utils` component of MLflow where dataset digests are computed using a weak hashing method (MD5 truncated to 8 characters) and a deterministic head-only sampling strategy. An attacker with local access can craft colliding datasets by maintaining identical data in the first 10,000 rows while modifying subsequent data, or by exploiting the exclusion of certain column types (datetime, bool) from the hash. This allows for predictable collisions (CWE-327/CWE-328). The issue is resolved in version 3.10.1 by implementing head+tail sampling, including all column types in the hash, and upgrading the algorithm to SHA-256 with a 128-bit output.
Affected products
- LF Projects MLflow < 3.10.1
Timeline
- 2026-04-07: disclosed: Pull request submitted to fix the issue
- 2026-06-04: advisory: NVD and GitHub Advisory published
- 2026-07-15: patched: GitHub Advisory updated to reflect patched version 3.10.1